7 ms·

why publish this before the patches are out?

• tedunangst 3y ago
  The patches are out.
  • a-dub 3y ago
    where? i couldn't find them on the openssh webpage and my distro has not released a new openssh either. edit: nvm. i see the release now. just no release for openbsd itself it seems.
    • tedunangst 3y ago
      http://www.openssh.com/releasenotes.html#9.3p2 http://www.openssh.com/releasenotes.html#9.3p2
    • davidcuddeback 3y ago
      > just no release for openbsd itself it seems. It was posted to announce@openbsd.org a few hours ago. Binary patches are available through syspatch and source patches on the errata page.
  • lxgr 3y ago
    It was arguably still not necessary to post the complete exploit chain/proof-of-concept on the same day, since the chaining of four different shared libraries present in Ubuntu probably does not immediately follow from the diff introduced by the fix.